GDPR audit: how to plan, conduct and report an internal audit of your data protection programme

What does the GDPR expect when it comes to auditing yourself?

A GDPR audit is an organisation testing, against the Regulation and its own policies, whether personal data is actually processed the way its records claim. No article sets a frequency or a format, so the obligation is assembled from several duties that only make sense if someone checks:

• Accountability, Article 5(2). The controller must be able to demonstrate that the principles are met.
• Controller responsibility, Article 24. The technical and organisational measures must be reviewed and updated where necessary.
• Security of processing, Article 32. Measures include, where appropriate, a process for regularly testing, assessing and evaluating how effective they are.
• The DPO's tasks, Article 39. Where a data protection officer is designated, monitoring compliance, including staff training and audits, is part of the role.

Processors carry a parallel expectation from the other side: among the Article 28(3) terms their contract must contain is making audit information available to the controller.

Because the Regulation gives no method, most organisations borrow one. ISO 19011, the guidance on auditing management systems (now in its 2026 edition), supplies the vocabulary of audit programme, plan, evidence, findings and conclusion.

Planning the GDPR audit programme

Start from the record of processing and the risk behind each activity, not from the list of articles. Activities involving special-category data, large-scale monitoring, many processors or transfers outside the EU and EEA earn more frequent attention; a low-risk internal newsletter list does not need a visit every quarter. Past findings, breaches and new systems also raise priority.

For a mid-sized controller with HR, customer and cloud-supplier processing, a year could run like this:

Each audit then gets its own plan: objectives, scope (which activities, entities and systems), criteria (the articles concerned plus your own policies and procedures), dates, auditees and auditors. The documents those criteria point to are described in the GDPR documentation guide (records, notices, contracts and DPIAs); the audit tests whether they are true.

Who should carry out a GDPR audit: competence and independence

A data protection auditor needs three things: a working knowledge of the Regulation at article level, enough grasp of the systems to follow data through them, and audit technique, meaning how to sample, question and record evidence without leading the answer. Pairing a privacy specialist with someone from IT or operations usually covers all three.

Independence is where GDPR programmes often slip. The DPO or privacy lead usually wrote the policies, chose the templates and signed off the DPIAs; if the same person audits them, the conclusions are hard to trust. Practical arrangements that hold up:

• The DPO owns the programme and sees every report, while trained auditors from other functions audit the areas the DPO designed.
• An external party audits the areas where no internal auditor is free of involvement, such as the DPO's own processes.

Keep evidence of competence; role training is covered in GDPR training: who needs what, and the evidence.

Conducting the audit: follow the data, not the folder

Prepare

Read the record entries in scope, the procedures and last year's findings, then choose samples before arriving so the auditee cannot pick the tidy ones.

Trace activities end to end

Pick one activity, such as recruitment, and follow it: where the application arrives, which notice the candidate saw, the lawful basis recorded, the Article 9 condition for any health data, who can open the file, which processor hosts it, whether that processor sits outside the EEA and on what safeguard, and when the file is deleted. Each step either matches the record or it does not.

Sample the logs

Interview and observe

Ask people to show rather than describe: how an agent verifies a caller, or what a manager does with an access request received by e-mail. Record the reference of each record examined.

Reporting, grading and following up GDPR audit findings

The Regulation has no major or minor categories, so define your grading in the audit programme and apply it consistently. A workable scale grades by the risk to the people whose data is involved: a high-risk nonconformity (for example, special-category data with no Article 9 condition, or a transfer with no safeguard), a nonconformity, and an observation for something compliant today but fragile.

Every finding states three things: the requirement (article or internal policy), the objective evidence with its reference, and the gap between them. "Consent is weak" is an opinion; "three of ten marketing contacts sampled had no record of the wording shown at sign-up, contrary to Article 7(1)" is a finding.

The process owner then records the correction, the root cause and the corrective action, with a date. The auditor verifies closure against new evidence, not a promise. Open findings and their trend go to the management review with the DPO or privacy lead, with the rights-request and breach statistics.

Keep programme, plans, reports, finding logs and closure evidence together; that file is part of what Article 5(2) asks you to show.

How the internal audit differs from a regulator or client audit

There is no certification body and no certificate for the GDPR as such, so the external checks come from three other directions. A supervisory authority can make enquiries of you, and its corrective powers under Article 58 run from warnings to a ban on processing. A customer, as controller, relies on the audit terms of its Article 28 contract with you as processor, usually through a questionnaire followed by a document review or site visit. And if you choose a certificate, an ISO/IEC 27701 certification body or an approved Article 42 scheme audits against its own criteria; the comparison is in GDPR vs ISO/IEC 27701, ISO/IEC 27001 and SOC 2.

Your internal audit is the only one of these you control. It chooses its own samples and finds weaknesses before anyone outside does. Where an ISO/IEC 27001 or ISO/IEC 27701 system already runs, one combined programme can cover the GDPR areas alongside the management-system clauses, provided the report shows which criteria each finding was raised against.

GDPR audit: questions buyers ask